Secure session capability using public-key cryptography without access to the private key
A first server receives a set of cryptographic parameters from a second server. The set of cryptographic parameters is received from the second server as part of a secure session establishment between a client device and the second server. The first server accesses a private key that is not stored on the second server. The first server signs the set of cryptographic parameters using the private key. The first server transmits the signed set of cryptographic parameters to the second server. The first server receives, from the second server, a request to generate a premaster secret using a value generated by the second server that is included in the request and generates the premaster secret. The first server transmits the premaster secret to the second server for use in the secure session establishment between the client device and the second server.
1. A method in a first server, comprising the first server performing the following:
receiving a set of cryptographic parameters from a second server, wherein the set of cryptographic parameters is received from the second server as part of a secure session establishment between a client device and the second server;
accessing a private key, wherein the private key is not stored on the second server;
signing the set of cryptographic parameters using the private key;
transmitting the signed set of cryptographic parameters to the second server;
receiving, from the second server, a request to generate a premaster secret using a value generated by the second server that is included in the request;
generating the premaster secret using the value generated by the second server that is included in the request; and
transmitting the premaster secret to the second server for use in the secure session establishment between the client device and the second server.
2. The method of claim 1 , further comprising the first server performing the following:
prior to transmitting the set of cryptographic parameters to the second server, participating in a secure session establishment procedure that establishes a secure session between the first server and the second server, wherein transmitting the set of cryptographic parameters to the second server is over secure session.
3. The method of claim 2 , wherein as part of participating in the establishment of the secure session, the first server performs the following:
requesting a certificate from the second server;
receiving the certificate from the second server; and
using the received certificate to authenticate the second server.
4. The method of claim 1 , further comprising the first server receiving, from the second server, an indication of a domain in which the client device is attempting to connect via the secure session, and wherein the accessed private key corresponds to a public key associated with the indicated domain.
5. The method of claim 1 , wherein prior to transmitting the set of cryptographic parameters to the second server, the first server verifying that the second server is communicating with the first server with an IP address having a value expected by the first server.
6. The method of claim 1 , wherein the secure session establishment between the client device and the second server uses a Diffie-Hellman key exchange mechanism.
7. An apparatus, comprising:
a first server to include a set of one or more processors and a set of one or more non-transitory computer-readable storage mediums that is to store instructions, that when executed by the set of processors, cause the set of processors to perform the following operations:
receive a set of cryptographic parameters from a second server, wherein the set of cryptographic parameters is to be received from the second server as part of a secure session establishment between a client device and the second server;
access a private key, wherein the private key is not stored on the second server;
sign the set of cryptographic parameters using the private key;
transmit the signed set of cryptographic parameters to the second server;
receive, from the second server, a request to generate a premaster secret using a value generated by the second server that is included in the request;
generate the premaster secret using the value generated by the second server that is included in the request; and
transmit the premaster secret to the second server for use in the secure session establishment between the client device and the second server.
8. The apparatus of claim 7 , wherein the set of one or more non-transitory computer-readable storage mediums further is to store instructions, that when executed by the set of processors, cause the set of processors to perform the following operations:
prior to transmission of the set of cryptographic parameters to the second server, participate in a secure session establishment procedure that establishes a secure session between the first server and the second server, wherein transmission of the set of cryptographic parameters to the second server is over secure session.
9. The apparatus of claim 8 , wherein as part of participation in the establishment of the secure session, the first server is to perform the following:
request a certificate from the second server;
receive the certificate from the second server; and
use the received certificate to authenticate the second server.
10. The apparatus of claim 7 , wherein the set of one or more non-transitory computer-readable storage mediums further is to store instructions, that when executed by the set of processors, cause the set of processors to perform the following operations:
receive, from the second server, an indication of a domain in which the client device is attempting to connect via the secure session, and wherein the accessed private key is to correspond to a public key associated with the indicated domain.
11. The apparatus of claim 7 , wherein the set of one or more non-transitory computer-readable storage mediums further is to store instructions, that when executed by the set of processors, cause the set of processors to perform the following operation:
prior to transmission of the set of cryptographic parameters to the second server, verify that the second server is communicating with the first server with an IP address having a value expected by the first server.
12. The apparatus of claim 7 , wherein the secure session establishment between the client device and the second server is to use a Diffie-Hellman key exchange mechanism.
13. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor of a first server, causes said processor to perform operations comprising:
receiving a set of cryptographic parameters from a second server, wherein the set of cryptographic parameters is received from the second server as part of a secure session establishment between a client device and the second server;
accessing a private key, wherein the private key is not stored on the second server;
signing the set of cryptographic parameters using the private key;
transmitting the signed set of cryptographic parameters to the second server;
receiving, from the second server, a request to generate a premaster secret using a value generated by the second server that is included in the request;
generating the premaster secret using the value generated by the second server that is included in the request; and
transmitting the premaster secret to the second server for use in the secure session establishment between the client device and the second server.
14. The non-transitory machine-readable storage medium of claim 13 further providing instructions that, when executed by the processor, causes the processor to perform the following:
prior to transmitting the set of cryptographic parameters to the second server, participating in a secure session establishment procedure that establishes a secure session between the first server and the second server, wherein transmitting the set of cryptographic parameters to the second server is over secure session.
15. The non-transitory machine-readable storage medium of claim 14 , wherein as part of participating in the establishment of the secure session, the first server performs the following:
requesting a certificate from the second server;
receiving the certificate from the second server; and
using the received certificate to authenticate the second server.
16. The non-transitory machine-readable storage medium of claim 13 further providing instructions that, when executed by the processor, causes the processor to perform the following:
receiving, from the second server, an indication of a domain in which the client device is attempting to connect via the secure session, and wherein the accessed private key corresponds to a public key associated with the indicated domain.
17. The non-transitory machine-readable storage medium of claim 13 further providing instructions that, when executed by the processor, causes the processor to perform the following:
prior to transmitting the set of cryptographic parameters to the second server, the first server verifying that the second server is communicating with the first server with an IP address having a value expected by the first server.
18. The non-transitory machine-readable storage medium of claim 13 , wherein the secure session establishment between the client device and the second server uses a Diffie-Hellman key exchange mechanism.